OTP · DigiLocker · ID → Consent with proof
Ask properly
Clear notice + verifiable parental consent for under-18. Checkbox ≠ verifiable.
THE DPDP ACT, 2023 — RULES NOTIFIED 14 NOV 2025
What is the DPDP Act?
Plain language. No jargon. If you handle names, photos, health or phone numbers — you're a Data Fiduciary.
THREE DUTIES THAT MATTER MOSTAsk. Answer.
Ask. Answer.
Report.
Three duties, one burden of proof. If you can't produce consent records, penalty applies. One complaint triggers inquiry.
RIGHTS SLA
- Access — 12h
- Correction — done
- Withdraw — pending
Answer when they ask
Access/correct/delete/withdraw within timelines. Deny with written reasons.
72hBoard
Breach armed
Report when it leaks
Inform people immediately + Board within 72 hours.
PENALTIES & TIMELINE
Window is shrinking.
Failing to protect children's data (no verifiable parental consent)₹200 crore
Failing security safeguards₹250 crore
Failing to report a breach₹200 crore
Failing other duties (notice, rights, transparency)₹150 crore
Burden of proof on you. One complaint → inquiry.
11 Aug 2023Act passed
14 Nov 2025Rules notified. Data Protection Board operational
13 Nov 2026Consent Manager framework goes live
13 May 2027Full enforcement. All penalties active. No grace period.
WHY DPDP WAS BUILT FOR HARD CASESMost tools were built for
Most tools were built for
easy data. DPDP wasn’t.
Children’s data, health records, breached Excels — Ninebloom handles the rest that copy-paste GDPR misses.
Reporting and version control built for teams that need to prove ROILive
CSAT analytics
Consent 94% · Vault 12h
Escalation & topics
Which vendor, when, why
80% resolution rate, tracked
Consent and rights auto-resolved. Graph rises with each retro campaign — 200 → 4,200 verified.
📈 Auto-resolution 80% ↑
A customer success team that stays
Your school, hospital or startup — we remember your vendors, your languages, your retention.
Ninebloom Success · replies in 2h · knows your stack
Security built for teams where data accountability is non-negotiable.
See full security documentation Certified and compliant
Audited annually against security, availability and confidentiality criteria. Compliant with EU data protection and US healthcare privacy standards.
Private Vault gateway
OTP and sensitive data are stripped before anything reaches storage. Documents are never sent for ingestion — only anonymized chunks that can’t be traced back.
Zero data retention
No retention on the provider side, no training on your data. You control retention periods for consents and vault logs to meet policy.
Audit and conversation logs
A full trail of what was collected, when and why. Every consent, correction and vendor share hash-chained for Board inquiries.
Consent integrity and sandboxing
Inputs sandboxed away from system prompts. Out-of-scope collection never reaches storage; topics and purposes can be blocked outright.
Vendor register — MCP server
All processors exposed as MCP tools — connect Tally, CRMs and gateways without custom integration. Works with your stack.
Data minimization
Purpose-limited collection enforced at form level. Extra fields flagged before consent, never stored silently — principle of minimal collection.
Verifiable parental consent
Every child record requires OTP-verified parent identity with DigiLocker optional. Proof retained for years, hash-chained.
One-click Board audit pack
Hash-chained ledger, vault logs and breach reports exported in one click. Ready for inquiry, no spreadsheet scramble.
Schools verify parents via OTP
Deep dive →HealthcareClinics need Patient Vault
Deep dive →StartupsSaaS needs tracker scan
Deep dive →